Authentication and extension bypass in Faye
Priority MEDIUM 45CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.
Why it matters now
EPSS 0.01573 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Faye (faye): 1.0.4, 1.1.3, 1.2.5faye (RubyGems): 1.0.4, 1.1.3, 1.2.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| faye | Faye | 0.5.0 to before 1.0.4; 1.1.0 to before 1.1.3; 1.2.0 to before 1.2.5 | 1.0.4, 1.1.3, 1.2.5 | Patch available | CNA |
| — | faye (RubyGems) | 0.5.0 to before 1.0.4 | 1.0.4 | Patch available | GHSA-qpg4-4w7w-2mq5 |
| — | faye (RubyGems) | 1.1.0 to before 1.1.3 | 1.1.3 | Patch available | GHSA-qpg4-4w7w-2mq5 |
| — | faye (RubyGems) | 1.2.0 to before 1.2.5 | 1.2.5 | Patch available | GHSA-qpg4-4w7w-2mq5 |
- Faye Vendorfaye Affected 0.5.0 to before 1.0.4; 1.1.0 to before 1.1.3; 1.2.0 to before 1.2.5 Fixed in 1.0.4, 1.1.3, 1.2.5 Patch available CNA
- faye (RubyGems) Vendor— Affected 0.5.0 to before 1.0.4 Fixed in 1.0.4 Patch available GHSA-qpg4-4w7w-2mq5
- faye (RubyGems) Vendor— Affected 1.1.0 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-qpg4-4w7w-2mq5
- faye (RubyGems) Vendor— Affected 1.2.0 to before 1.2.5 Fixed in 1.2.5 Patch available GHSA-qpg4-4w7w-2mq5
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:* | after 0.5.0, before 1.0.4 | Vulnerable | Faye Project |
| cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:* | after 0.5.0, before 1.0.4 | Vulnerable | Faye Project |
| cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:* | 1.1.0 to before 1.1.3 | Vulnerable | Faye Project |
| cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:* | 1.1.0 to before 1.1.3 | Vulnerable | Faye Project |
| cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:* | 1.2.0 to before 1.2.5 | Vulnerable | Faye Project |
| cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:* | 1.2.0 to before 1.2.5 | Vulnerable | Faye Project |
- cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:* Versions after 0.5.0, before 1.0.4 Vulnerable ·Faye Project
- cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:* Versions after 0.5.0, before 1.0.4 Vulnerable ·Faye Project
- cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:* Versions 1.1.0 to before 1.1.3 Vulnerable ·Faye Project
- cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:* Versions 1.1.0 to before 1.1.3 Vulnerable ·Faye Project
- cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:* Versions 1.2.0 to before 1.2.5 Vulnerable ·Faye Project
- cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:* Versions 1.2.0 to before 1.2.5 Vulnerable ·Faye Project
Remediation
- Fix · CNA Faye (faye) Fixed in 1.0.4, 1.1.3, 1.2.5
- Fix · GHSA-qpg4-4w7w-2mq5 faye (RubyGems) Fixed in 1.0.4 Advisory →
- Fix · GHSA-qpg4-4w7w-2mq5 faye (RubyGems) Fixed in 1.1.3 Advisory →
- Fix · GHSA-qpg4-4w7w-2mq5 faye (RubyGems) Fixed in 1.2.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11020
- 2026-10-03 Alias added: GHSA-qpg4-4w7w-2mq5
References
More faye vulnerabilities
- TI-2026-39323 websocket-driver: Message corruption via abuse of protocol length headers CVSS 4.0CRITICAL 9.2
- TI-2026-44153 websocket-driver: Denial of service via malformed Host header CVSS 4.0HIGH 8.9
- TI-2020-11907 Missing TLS certificate verification in Faye CVSS 3.1HIGH 8.7
- TI-2020-11906 Missing TLS certificate verification in Faye Websocket CVSS 3.1HIGH 8.7
- TI-2026-39320 websocket-driver: Memory exhaustion via abuse of protocol length headers CVSS 4.0MEDIUM 6.9
- TI-2026-39336 websocket-driver: Resource limit bypass via message compression CVSS 4.0MEDIUM 6.3
Sources
- CVE-2020-11020 · CVE Program
- CVE-2020-11020 · NVD
- FIRST EPSS
- GHSA-qpg4-4w7w-2mq5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences